ARCV-670 Virus

Virus Name: ARCV-670 Aliases: V Status: Rare Discovery: March, 1993 Symptoms: .COM file growth; system hangs Origin: England Eff Length: 670 Bytes Type Code: PNCK - Parasitic Non-Resident .COM Infector Detection Method: AVTK, Sweep, ViruScan, IBMAV, F-Prot, NAV, NAVDX, VAlert, PCScan, ChAV, Sweep/N, NShld, AVTK/N, NProt, IBMAV/N, Innoc, NAV/N, LProt Removal Instructions: Delete infected files General Comments: The ARCV-670 virus was submitted in March, 1993, and is from England. ARCV-670 is a non-resident, direct action infector of .COM programs, including COMMAND.COM. When a program infected with the ARCV-670 virus is executed, this virus will infect one .COM program located in the current directory, though it does not infect .COM programs smaller than the virus itself. Infected programs will have a file length increase of 670 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will not be altered. The following text string is encrypted within the viral code in all infected files: "*.com *.*" Once all of the .COM files have become infected in the current and higher level directories, a system hang will occur when the virus attempts to infect another file.